Large-scale enterprise software systems commonly run as unprivileged service accounts to enforce least privilege, yet still depend on a small set of privileged components -- such as executables with elevated ownership, permissions, or capabilities -- for narrowly scoped operations. This creates a persistent security and operational conflict during maintenance. Automated patching tools running without elevated privileges cannot safely update privileged components without either executing the entire patch with full administrative rights or requiring manual administrator intervention. We present a secure, manifest-based infrastructure for delegated promotion of privileged software components, deployed in production as part of a large-scale enterprise database system serving both cloud and on-premises installations. The design centers on a minimal privileged mediator that validates cryptographically protected metadata and allows an unprivileged process to promote only vendor-approved files. The system explicitly mitigates Time-of-Check-to-Time-of-Use (TOCTOU) attacks using file-descriptor-bound validation and promotion, supports offline key rotation and revocation, and enables zero-downtime self-update via atomic replacement.

翻译：大规模企业软件系统通常以无特权服务账户运行以遵循最小权限原则，但仍依赖少量特权组件（例如具有提升所有权、权限或能力的可执行文件）执行范围受限的操作。这在维护过程中造成了持久的安全与运维冲突。若自动化补丁工具没有提升权限运行，就无法安全更新特权组件——除非以完全管理权限执行整个补丁程序，或需要人工管理员介入。我们提出了一种基于清单的安全基础设施，用于委托提升特权软件组件，该方案已在同时服务云端与本地部署的大型企业数据库系统中投入生产。该设计围绕一个最小化特权中介展开，用于验证经密码学保护的元数据，使无特权进程仅能提升供应商批准的文件。系统通过绑定文件描述符的验证与提升机制明确缓解了检查时到使用时（TOCTOU）攻击，支持离线密钥轮换与撤销，并通过原子替换实现零停机自更新。